Re: how to block ICMP tunneling?

[Ted Doty <ted () iss net>]

At 12:07 PM 7/16/99 -0400, Razvan Peteanu wrote:
> BO2K has the ability to use ICMP tunneling for its traffic so I'm interested
> in what types of ICMP messages should be blocked to prevent this traffic.

This is unclear, since the BO2K tunneling over ICMP is not working yet (at
least in the version I've seen).  However, since BO2K is open source, you
should expect this to mutate.

- Ted

-----------------------------------------------------------------------
Ted Doty, Internet Security Systems          | Phone: +1 678 443-6000
6600 Peachtree Dunwoody Road, 300 Embassy Row | Fax:   +1 678 443-6479
Atlanta, GA 30328  USA                       | Web: http://www.iss.net
-----------------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE